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Remarks 

Reconsideration of this Application is respectfully requested. 

Upon entry of the foregoing amendment, claims 1-28 are pending in the 
application, with claims 1, 14, 21, 27 and 28 being the independent claims. Claim 1 is 
sought to be amended to clarify the claim. These changes are believed to introduce no 
new matter, and their entry is respectfully requested. 

Based on the above amendment and the following remarks, Applicants 
respectfully request that the Examiner reconsider all outstanding rejections and that they 
be withdrawn. 

Rejection under 35 U.S.C. § 101 

The Examiner rejected claims 1-13 as being allegedly directed towards non- 
statutory subject matter. Applicants respectfully request reconsideration and withdrawal 
of this rejection for the reasons stated below. 

On page 4 of the Office Action the Examiner states, which Applicants do not 
acquiesce to, that Applicants' specification "provides intrinsic evidence that these claims 
[1-13] are directed towards software alone." Applicants disagree and respectfully 
traverse for the reasons stated below. 

As noted by the Examiner, claims 1-13 recite a document security system. 
Although Applicants believe the claims are directed to patent-eligible subject matter as 
previously pending in the application, Applicants have amended claim 1 merely in order 
to expedite prosecution and without acquiescing to the Examiner's point of view with 
regard to what the specification implies or does not imply. Applicants have amended 
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claim 1 to recite, a document security system for restricting access to secured documents, 
the system comprising: 

a processor; 

a policy system configured to enable the processor to store at least 
one process-driven security policy on a computer readable storage 
medium, wherein the process-driven security policy includes a plurality of 
states and transition rules, and wherein each of the states is associated 
with one or more access restrictions, and wherein the transition rules 
specify circumstances under which a secured document is to transition 
from one state to another; and 

an access manager configured to enable the processor to access the 
process-driven security policy and determine whether access to a secured 
document is permitted by a requestor based on the policy state associated 
therewith at the time access is requested and the corresponding one or 
more access restrictions thereof for the process-driven security policy. 

Support for the amendments to claim 1 is found at least at, for example, 

paragraphs [0015], [0018], [0019], [0085], [0086], and [0093] and FIG. 7 of the instant 

specification. 

Claim 1 as amended herein is directed to patent-eligible subject matter. Claims 
2-13 depend from claim 1. Accordingly, Applicants respectfully request that the 
Examiner reconsider and withdraw this rejection of claims 1-13 under 35 U.S.C. § 101 
and find them allowable. 



Rejection under 35 U.S.C. § 102 

The Examiner rejected claims 1-9, 11, 13-18 and 27 under 35 U.S.C. § 102(e) as 
allegedly being anticipated by U.S. Patent No. 6,584,466 to Serbinis et al. ("Serbinis"). 
Applicants respectfully traverse this rejection. 
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Claims 1-13 

Claim 1 recites features that distinguish over the applied reference. For example, 
claim 1 recites, inter alia: 

a policy system configured to enable the processor to store at least 
one process-driven security policy on a computer readable storage 
medium, wherein the process-driven security policy includes a plurality of 
states and transition rules, and wherein each of the states is associated 
with one or more access restrictions, and wherein the transition rules 
specify circumstances under which a secured document is to transition 
from one state to another; and 

an access manager configured to enable the processor to access the 
process-driven security policy and determine whether access to a secured 
document is permitted by a requestor based on the policy state associated 
therewith at the time access is requested and the corresponding one or 
more access restrictions thereof for the process-driven security policy 

On pages 5 and 6 of the Office Action the Examiner asserts that Serbinis 
discloses all of the above-noted distinguishing features recited in claim 1. Applicants 
respectfully disagree and traverse for the reasons stated below. 

Serbinis does not describe each and every element as set forth in claim 1. For 
example, Applicants have examined the sections of Serbinis cited by the Examiner and 
other sections, and are unable to identify a disclosure of at least one process-driven 
security policy that includes a plurality of states and transition rules, wherein each of the 
states is associated with one or more access restrictions, and wherein the transition rules 
specify circumstances under which a secured document is to transition from one state to 
another, as recited in claim 1. Serbinis may discuss a document management service 
(DMS) "that automatically modifies the state of a document instance based on its current 
state, the active date/time, and expiration date/time" (Serbinis, col. 7, Ins. 63-65). 
However, Applicants submit that automatic modification of a state of a document 
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instance based on the document instance's state, active date/time, and expiration 

date/time fails to disclose a process-driven security policy including a plurality of states 

and transition rules, wherein the transition rules specify; circumstances under which a 

secured document is to transition from one state to another, as recited in claim 1 . 

Serbinis may generally suggest that "documents stored in the DMS system are monitored 

by a document state process that automatically modifies the state of a document 

instance" (Serbinis, col. 7, Ins. 63-67). However, Serbinis does not teach or suggest a 

process-driven security policy that includes a plurality of states and transition rules, 

wherein the transition rules specify circumstances under which a secured document is to 

transition from one state to another, as recited in claim 1 . In Serbinis' DMS system, 

"states for a document instance include "pending," "active," "archived," "canceled" and 

"deleted"" (Serbinis, col. 7, In. 67- col. 8, In. 4), but Serbinis is silent on a process-driven 

security policy including a plurality of states and transition rules, wherein the transition 

rules specify circumstances under which a secured document is to transition from one 

state to another, as recited in claim 1 . Serbinis' document instance states are not 

analogous to the plurality of process-driven security policy states recited in claim 1 . In 

Serbinis, secured documents do not transition from one state to another as a result of a 

process-driven security policy; rather "[t]he state of these documents is changed to 

"deleted" after a pre-determined amount of time" (Serbinis, col. 8, Ins. 18-20). 

Further, Applicants are unable to identify in Serbinis any disclosure of an access 

manager configured to enable a processor to access a process-driven security policy and 

determine whether access to a secured document is permitted by a requestor based on the 

policy state associated therewith at the time access is requested and the corresponding 
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one or more access restrictions thereof for the process-driven security policy, as recited 
in claim 1 . On page 6 of the Office Action, the Examiner states that the functions of the 
above-recited access manager of claim 1 are disclosed by Serbinis in passages in 
columns 8-10. Serbinis may generally suggest that an "Authorized User may then 
request retrieval of the document" from a data store "and any automatic filtering, or 
filtering selected by the Authorized User, may be performed during the document 
download process" before "[t]he document is then downloaded to the Authorized User" 
(Serbinis, col. 9, In. 66-col. 10, In. 4). However, Serbinis does not disclose the above- 
noted features of the access manager recited in claim 1 . 

Therefore, for at least these reasons, the applied reference does not anticipate 
claim 1. Dependent claims 2-13, which depend upon independent claim 1, are allowable 
for at least being dependent from allowable independent claim 1, in addition to their own 
respective distinguishing features. See In Re Fine, 837 F.2d 1071 (Fed. Cir. 1988) and 
M.P.E.P. §2143.03. 



Claims 14-20 and 27 

Independent claims 14 and 27 recite features that distinguish over the applied 
reference. For example, claims 14 recites: 

(a) receiving an event; 

(b) determining whether the event causes a state transition for the at 
least one secured document from a former state to a subsequent state of 
the security-policy state machine; and 

(c) automatically transitioning from the former state to the subsequent 
state of the security-policy state machine when determining step (b) 
determines that the event causes the state transition. 
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Claim 27 recites computer program code that when executed by a processor, 

causes a processor to: 

detect an occurrence of an event; 

determine whether the event causes a state transition for at least 
one secured document from a former state to a subsequent state of a 
security-policy state machine having a plurality of states; and 

automatically transition from the former state to the subsequent 
state of the security-policy state machine upon determining that the event 
causes the state transition. 

Although Serbinis may discuss "a document state process that automatically 
modifies the state of a document instance based on its current state, the active date/time, 
and expiration date/time" (Serbinis, col. 7, Ins. 63-67), Serbinis does not teach or suggest 
automatically transitioning from the former state to the subsequent state of the security- 
policy state machine upon determining that an event causes the state transition, as recited 
in claims 14 and 27. Document instances in Serbinis transition based upon an "expiry 
date" (Serbinis, col. 7, Ins. 32-37). In Serbinis* system, document instance states 
"transition when the expiration time is reached", "after a pre-determined amount of 
time", or "when an Authorized User (typically the Originator) forces a document to 
expire before the expiration time" (Serbinis, col. 8, Ins. 12-29). Claims 14 and 27 recite, 
using respective language, automatically transitioning a secured document from a 
former state to a subsequent state of the security-policy state machine upon determining 
that a detected event causes the state transition. In contrast to the above-noted 
distinguishing features of claims 14 and 27, Serbinis is limited to modifying the state of a 
document instance based on its current state, the active date/time, and expiration 
date/time (the expiry date) (Serbinis, col. 7, Ins. 32-37 and 63-67). 
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Therefore, for at least these reasons, the applied reference does not anticipate 

claims 14 and 27. Also, at least based on their respective dependencies to claim 14, 

claims 15-20 should be found allowable, as well as for their additional respective 

distinguishing features. Accordingly, Applicants respectfully request that the Examiner 

reconsider and withdraw the rejections of these claims, and find them allowable over the 

applied reference. 

Rejections under 35 U.S.C. § 103 

Claim 10 is rejected under 35 U.S.C. § 103(a) as being allegedly unpatentable 
over Serbinis in view of U.S. Patent Publication No. 2004/0193912 to Li et al. ("Li"). 
Applicants respectfully traverse this rejection. 

Claims 12, 19 and 20 are rejected under 35 U.S.C. § 103(a) as being allegedly 
unpatentable over Serbinis in view of U.S. Patent No. 6,341,164 to Dilkie et al 
("Dilkie"). Applicants respectfully traverse this rejection. 

Claims 10, 12, 19, and 20 depend upon claim 1. As argued above, claim 1 is 
allowable over Serbinis. Thus, claims 10, 12, 19, and 20 are allowable for at least being 
dependent from allowable independent claim 1, in addition to their own respective 
distinguishing features. See In Re Fine, 837 F.2d 1071 (Fed. Cir. 1988) and M.P.E.P. § 
2143.03. 

Claims 21-26 and 28 are rejected under 35 U.S.C. §103(a) as being allegedly 
unpatentable over Serbinis in view of U.S. Patent Publication No. 2005/0028006 to Leser 
et al. ("Leser"). Applicants respectfully traverse this rejection. 
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Claims 21-26 and 28 

Regarding the Examiner's statement on page 15 of the Office Action, in which 
the Examiner asserts that the allegedly obvious combination of Serbinis and Leser 
discloses the method and computer readable medium recited in claims 21 and 28, 
respectively, Applicants disagree and traverse for the reasons stated below. 

Claim 21 recites a method for, inter alia: 

providing a reference to the process-driven security policy to at a client 
computer, the reference referring to the process-driven security policy 
resident on the server computer. 

Claim 28 recites a computer readable storage medium having computer program 
code recorded thereon, that when executed by a processor, causes a processor to: 

provide a reference to the process-driven security policy at a client 
machine, wherein the reference refers to the process-driven security 
policy resident on the server machine. 

As noted by the Examiner on page 15 of the Office Action, Serbinis does not 
disclose the above-noted features of claims 21 and 28. 

Rather, the Examiner relies on Leser to teach or suggest these features. Leser 
does not cure these deficiencies of Serbinis with regards to claims 21 and 28. 

On pages 15 and 16 of the Office Action the Examiner states, which Applicants 
do not acquiesce to, that Leser discloses the above-noted features of claims 21 and 28 
and that it would have been obvious to "cache [the] security-policy of the system of 
Serbinis into the user's computers thereby enabling them to generate and or use protected 
document[s] while they are offline." However, Leser is not stated by the Examiner to 
teach, nor does it teach or suggest, providing at least one process-driven security policy 
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at a server machine or computer, wherein the process-driven security policy is associated 

with a plurality of states, and wherein each of the states has distinct access restrictions, as 

recited, using respective language, in claims 21 and 28. As discussed above with regards 

to claims 14 and 27, Serbinis is limited to modifying the state of a document instance 

based on its current state, the active date/time, and an expiration date/time (Serbinis, coL 

7, Ins. 63-67). Thus, Serbinis fails to teach or suggest at least a process-driven security 

policy, wherein the process-driven security policy is associated with a plurality of states, 

and wherein each of the states has distinct access restrictions, as recited in claims 21 and 

28. 

Thus, as Leser does not cure the deficiencies of Serbinis, the combination of the 
applied references cannot be used to establish a prima facie case of obviousness with 
regards to claims 21 and 28. 

Accordingly, Applicants respectfully request that the Examiner reconsider and 
withdraw rejection of these claims, and find them allowable over the applied references. 

Also, claims 22-26, which depend from independent claim 21, are allowable for 
at least being dependent from allowable claim 21, in addition to their own respective 
distinguishing features. 
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Conclusion 

All of the stated grounds of rejection have been properly traversed, 
accommodated, or rendered moot. Applicants therefore respectfully request that the 
Examiner reconsider all presently outstanding rejections and that they be withdrawn. 
Applicants believe that a full and complete reply has been made to the outstanding 
Office Action and, as such, the present application is in condition for allowance. If the 
Examiner believes, for any reason, that personal communication will expedite 
prosecution of this application, the Examiner is invited to telephone the undersigned at 
the number provided. 

Prompt and favorable consideration of this Amendment and Reply is respectfully 
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